containerd二进制安装部署教程

admin

systemctl stop firewalld
systemctl disable firewalld
iptables -F && iptables -X && iptables -F -t nat && iptables -X -t nat
iptables -P FORWARD ACCEPT
swapoff -a
sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
setenforce 0
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

echo '* soft nofile 65535'>>/etc/security/limits.conf
echo '* hard nofile 65535'>>/etc/security/limits.conf
echo '* soft nproc unlimited'>>/etc/security/limits.conf
echo '* hard nproc unlimited'>>/etc/security/limits.conf
echo '* soft core unlimited'>>/etc/security/limits.conf
echo '* hard core unlimited'>>/etc/security/limits.conf
echo '* soft memlock 50000000'>>/etc/security/limits.conf
echo '* hard memlock 50000000'>>/etc/security/limits.conf
yum -y install socat conntrack ebtables ipset ipvsadm chrony jq iptables curl sysstat libseccomp wget socat git
mkdir -p /opt/src/
cd /opt/src/
#wget https://github.com/containerd/co ... -linux-amd64.tar.gz
#wget https://github.com/opencontainer ... d/v1.1.4/runc.amd64
#wget https://github.com/containernetw ... ux-amd64-v1.2.0.tgz
#wget https://github.com/containerd/ne ... -linux-amd64.tar.gz
#wget https://github.com/kubernetes-si ... -linux-amd64.tar.gz

mkdir -p /opt/src/cni
mkdir -p /opt/cni/bin/
mkdir -p /etc/containerd/
cd /opt/src/

tar zxvf containerd-1.6.16-linux-amd64.tar.gz
tar xvf cni-plugins-linux-amd64-v1.2.0.tgz -C /opt/cni/bin/
tar xvf nerdctl-1.2.0-linux-amd64.tar.gz
tar zxvf crictl-v1.26.0-linux-amd64.tar.gz
cp crictl /usr/bin/
install -m 755 runc.amd64 /usr/sbin/runc
cp -rf bin/* /usr/bin/
cp nerdctl /usr/bin/

cat > /etc/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target
[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/bin/containerd
Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
TasksMax=infinity
OOMScoreAdjust=-999
[Install]
WantedBy=multi-user.target
EOF

containerd config default > /etc/containerd/config.toml
sed -i 's/oom_score = 0/oom_score = -999/g' /etc/containerd/config.toml
sed -i 's@config_path = ""@config_path = "/etc/containerd/certs.d"@g' /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml

mkdir -p /etc/containerd/certs.d
mkdir -p /etc/containerd/certs.d/docker.io
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://docker.io"
[host."https://docker.mirrors.ustc.edu.cn"]
  capabilities = ["pull", "resolve"]
EOF
mkdir -p /etc/containerd/certs.d/gcr.io
cat > /etc/containerd/certs.d/gcr.io/hosts.toml << EOF
server = "https://gcr.io"
[host."https://gcr.mirrors.ustc.edu.cn"]
  capabilities = ["pull", "resolve"]
EOF
mkdir -p /etc/containerd/certs.d/k8s.gcr.io
cat > /etc/containerd/certs.d/k8s.gcr.io/hosts.toml << EOF
server = "https://k8s.gcr.io"
[host."https://gcr.mirrors.ustc.edu.cn/google-containers/"]
  capabilities = ["pull", "resolve"]
EOF
mkdir -p /etc/containerd/certs.d/quay.io
cat > /etc/containerd/certs.d/quay.io/hosts.toml << EOF
server = "https://quay.io"
[host."https://quay.mirrors.ustc.edu.cn"]
  capabilities = ["pull", "resolve"]
EOF

cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF


systemctl enable containerd --now